authentication with authorization header